By A critical buffer overflow in TianoCore EDK II — the reference firmware codebase used by virtually every UEFI implementation on the planet — lets unauthenticated attackers execute arbitrary code before the operating system loads. CVE-2026-97631 scored a 9.5 out of 10 on CVSS v4. A fix landed in a public GitHub pull request on October 15. Your server vendors almost certainly haven’t shipped it yet.
The Bug, in Plain Terms
The PXE boot driver inside EDK II maintains a fixed 504-byte buffer called Mode.IcmpError for storing ICMP error messages during network boot. Both the IPv4 and IPv6 handlers in PxeBcSupport.c copy incoming ICMP packets into this buffer without properly checking the packet’s size first. Send a crafted oversized ICMP error to a machine’s IP address while it’s PXE-booting, and you’ll overflow the buffer into adjacent DXE-phase memory — memory that controls what code runs at ring 0, before the OS takes over.
This is the DXE (Driver Execution Environment) phase, which runs after the CPU initializes but before the bootloader hands off to the OS. Importantly, it also runs before Secure Boot validates anything. That matters: Secure Boot does not protect you here. This flaw executes earlier in the boot sequence than Secure Boot’s signature checks, making it a layer below any software defense you have.
Who’s Actually Exposed to CVE-2026-97631
Not every machine. PXE boot — booting from the network rather than a local disk — has to be enabled and in active use. Home machines typically aren’t running PXE. Data centers are a different story. Bare-metal provisioning, Kubernetes node setup, CI/CD pipelines on bare metal, cloud provider substrate — all of these commonly rely on PXE to deploy and re-image servers at scale.
For an attacker, the requirements are minimal: be on the same network as a machine that’s PXE-booting, and deliver a crafted ICMP error packet to its IP during the boot window. No authentication required. No user interaction. The exposure window lasts as long as the PXE sequence runs — seconds to minutes, depending on the environment.
TianoCore EDK II is the reference code behind three dominant UEFI firmware suppliers: AMI, Insyde, and Phoenix. That covers the vast majority of enterprise and server hardware. Microsoft’s hardened EDK2 fork, Project Mu, is reportedly affected as well. Using the reference code doesn’t automatically mean a vendor ships every flaw in every build, but it means AMI, Insyde, Phoenix, and Microsoft all have to audit their specific builds and push independent updates.
The Embargo Didn’t Hold
The researchers who discovered this — Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google) — had arranged a coordinated disclosure targeting January 2027, giving vendors a realistic runway to build and ship firmware updates. In October, a TianoCore maintainer accidentally opened the fix pull request (#13302) publicly before the embargo window closed. The disclosure timeline collapsed. The official advisory GHSA-99cj-7hg9-mp4m was published on October 22, two-plus months ahead of schedule. Ars Technica covered it on October 27, and it hit the Hacker News front page the same day.
The uncomfortable position this creates: the vulnerability mechanics are now fully public, but no vendor has shipped a patched firmware image. That gap — between a public CVE and available remediation — is when these flaws are most dangerous. For context, the Tailscale lateral movement issue covered here recently had a patch available within 24 hours. UEFI firmware supply chains don’t move that fast.
What to Do Right Now
Since vendor firmware updates don’t exist yet, your options are mitigations rather than full remediation. Here’s where to start:
- Disable PXE boot in UEFI settings on any machine that doesn’t require network booting. Most production servers don’t need it after initial provisioning.
- Isolate PXE traffic on dedicated VLANs with strict access controls. PXE boot traffic should never be reachable from general-purpose network segments or shared provisioning networks.
- Block unexpected ICMP at the network layer targeting machines during provisioning windows. Rate-limiting and filtering ICMP error messages to provisioning subnets narrows the attack surface significantly.
- Inventory your firmware suppliers. Find out whether your servers run AMI, Insyde, or Phoenix UEFI. Contact your hardware vendor and ask explicitly for a timeline on firmware that includes the EDK II fix.
The fix itself — pull request #13302 — adds proper boundary checks, corrects pointer arithmetic in both IPv4 and IPv6 handlers, initializes the buffer with ZeroMem before each operation, and uses the MIN() macro to clamp oversized inputs. Once vendors integrate and ship it, a firmware update is full remediation. More detailed vendor-specific steps are available at CybersecurityNews.
A Familiar Pattern
This is the third major UEFI network boot vulnerability in two years. PixieFail in 2024 disclosed nine CVEs in the same PXE stack. The pattern repeats: a lean open-source team maintains the reference firmware that underlies billions of dollars in enterprise hardware. When a flaw surfaces, the upstream fix can be fast. Getting it into shipping firmware takes months — sometimes over a year — because every vendor runs an independent build and validation pipeline. That structural lag keeps creating these windows where the CVE is fully public before any patch reaches production systems. It also means the lessons from supply chain RCEs keep having to be relearned one layer deeper in the stack.
For now: check your PXE exposure, isolate your provisioning network, and start the conversation with your hardware vendors. The fix exists. Getting it to your servers is the part that takes time.
